| *** chandankumar is now known as chkumar|rover | 08:42 | |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Add ansible.utils collectoin requirement https://review.opendev.org/c/openstack/openstack-ansible/+/831525 | 09:15 |
|---|---|---|
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Update netcommon collection https://review.opendev.org/c/openstack/openstack-ansible/+/833117 | 09:19 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-galera_server master: Change location of ipaddr filter https://review.opendev.org/c/openstack/openstack-ansible-galera_server/+/831526 | 09:20 |
| opendevreview | Andrew Bonney proposed openstack/openstack-ansible-os_nova master: Add configuration option for heartbeat_in_pthread https://review.opendev.org/c/openstack/openstack-ansible-os_nova/+/833236 | 09:33 |
| opendevreview | Andrew Bonney proposed openstack/openstack-ansible-os_neutron master: Add configuration option for heartbeat_in_pthread https://review.opendev.org/c/openstack/openstack-ansible-os_neutron/+/833237 | 09:33 |
| opendevreview | Andrew Bonney proposed openstack/openstack-ansible-os_cinder master: Add configuration option for heartbeat_in_pthread https://review.opendev.org/c/openstack/openstack-ansible-os_cinder/+/833238 | 09:34 |
| opendevreview | Andrew Bonney proposed openstack/openstack-ansible master: Disable heartbeat_in_pthread for non-uwsgi services https://review.opendev.org/c/openstack/openstack-ansible/+/833239 | 09:34 |
| MrClayPole | Hi, We are losing access to our public DNS and we have to migrate to a new public DNS on our OSA Train deployment. I'm guessing I just need to update "external_lb_vip_address" and then run the haproxy and setup-openstack playbooks (I can see it reference in a lot of the sub-playbooks). Should this be ok or is there more to consider? We'll also be replacing the SSL cert as well | 09:41 |
| noonedeadpunk | MrClayPole: so you're changing domain name, right? I guess you will need to manually drop endpoints after re-running playbooks | 10:01 |
| MrClayPole | Thats correct. Thanks I add that to my migration plan | 10:02 |
| noonedeadpunk | And you're using internal_lb_vip as domain name as well? | 10:05 |
| opendevreview | Andrew Bonney proposed openstack/openstack-ansible master: Disable heartbeat_in_pthread for non-uwsgi services https://review.opendev.org/c/openstack/openstack-ansible/+/833239 | 10:20 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-galera_server master: Update MariDB version to 10.6.7 https://review.opendev.org/c/openstack/openstack-ansible-galera_server/+/833259 | 10:51 |
| MrClayPole | noonedeadpunk: No just the "external_lb_vip_address" | 11:00 |
| anskiy | Are you talking about LE support by any chance? :) | 11:01 |
| noonedeadpunk | anskiy: which we have for quite some time? :) | 11:02 |
| MrClayPole | Currently I'm being force to use our companies wildcard cert but would like to move to LE as cert are a pain in the bum | 11:05 |
| MrClayPole | plus LE is broken in OSA train so would have to wait until we upgraded before I could deploy | 11:08 |
| *** dviroel|out is now known as dviroel|ruck | 11:12 | |
| noonedeadpunk | Hm, is it? | 11:20 |
| noonedeadpunk | haven't we fixed that? | 11:20 |
| admin1 | enabling LE broke some of my UI/API requests every N turn (like round robin) .. so i am back to professional * wildcard certs | 11:34 |
| anskiy | well, it seems LE support is broken in xena (and wallaby) too, and I do believe it ended in that state with this change: https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/813945. According to docs `external_lb_vip_address` should be set to hostname (and complimentary `haproxy_bind_external_lb_vip_address` should be set to IP) and after that change `haproxy_bind_external_lb_vip_address` is fed to `cer | 11:38 |
| noonedeadpunk | anskiy: it seems that end of message was cut | 11:44 |
| noonedeadpunk | But I guess I got idea. except that haproxy_bind_external_lb_vip_address defaults to external_lb_vip_address | 11:46 |
| MrClayPole | noonedeadpunk: LE in train reaches out to a depracated script/service. Last time we spoke you suggested we back port from Ussrui as it had be re-writen but as I'm planning to upgrade soon to Victoria I though I would leave it until I upgrade. | 11:52 |
| noonedeadpunk | well, that's bad mindset, as you could also help others with backporting stuff ;) | 11:53 |
| noonedeadpunk | and basically landing fix | 11:53 |
| MrClayPole | If only I had the skills, I'm a little nervous of "doing it wrong" | 11:54 |
| MrClayPole | If I did back port how would I know if I broke someones existing deployment? | 11:58 |
| anskiy | noonedeadpunk: yeah, but if you don't set `haproxy_bind_external_lb_vip_address` to IP-address, then domain name from `external_lb_vip_address` ends up in haproxy's bind directive, which breaks it :) | 11:59 |
| *** dviroel is now known as dviroel|ruck | 12:20 | |
| mgariepy | morning everyone | 12:55 |
| MrClayPole | anskiy: I've found that as long as you set "external_lb_vip_address" to your public DNS and then ensure that either via the /etc/hosts or local DNS resolves to the VIP of the load balancers then haproxy binds ok. | 13:06 |
| jrosser | afaik. I thing is wrong with LE in train, I don’t know about deprecated scripts at all | 13:10 |
| jrosser | it requires a bunch more config in older releases than new ones | 13:10 |
| jrosser | *nothing is wrong with….. | 13:11 |
| noonedeadpunk | Yeah for some point I was sure that haproxy should bind nicely as long as it can resolve DNS... | 13:11 |
| jrosser | we’ve run it since T so if anyone needs advice on a setup just ask | 13:12 |
| noonedeadpunk | but you're right that it might worth improving things with adding new variable for domain name for which cert will be issued, if this makes confusion | 13:13 |
| jrosser | we’ve had a few issues when people set their hostname to the fqdn | 13:14 |
| jrosser | but that’s kind of expected to break things, imho | 13:14 |
| jrosser | anskiy: if you think it is broken please raise a bug? | 13:18 |
| jrosser | MrClayPole: similarly, iirc for Train the LE support was extremely basic and did not support more than one controller. it would have never worked on an HA deployment | 13:20 |
| jrosser | I refactored the whole thing for Ussuri to be HA capable | 13:21 |
| jrosser | then for V onward the variables had a really big tidy up to make the integration with haproxy very straightforward | 13:22 |
| anskiy | MrClayPole: ugh, I've double checked it, and now it works :(. Maybe I've got some resolving issues at that time (and systemd-resolved cached that error), but haproxy proxy docs explicitly state that it is supposed to be IP-address, that's why I was so sure. Nevertheless, I've already hacked the playbook a bit. | 13:23 |
| noonedeadpunk | you should have really filled in bug report at least ;( | 13:24 |
| jrosser | admin1: also if you have 1-in-N failures the. you need to debug rather than give up :) certbot independently runs for each controller so it has to succeed for each controller or you will get errors | 13:24 |
| jrosser | though that really sounds like something totally not to do with LE | 13:25 |
| jrosser | 1-in-N errors are related to round robin on the backends, not the cert on the front end | 13:27 |
| anskiy | noonedeadpunk: but it works as expected, it's just my misunderstanding and kinda "used to see" IPs in bind directives. Sorry :) | 13:27 |
| noonedeadpunk | oh, ok then | 13:33 |
| noonedeadpunk | andrewbonney: regarding heartbeat_in_pthread - my second thought next to splitting configs, was to add logic to templates, as we close to never will want it for wsgi? and then super easy to exclude neutron-server if needed | 13:40 |
| noonedeadpunk | but if you say that schedulers/conductors not affected current way is fine for me as well | 13:41 |
| andrewbonney | Yeah I'd be happy to do that if preferred, even if just for neutron. I did consider adding something there myself but thought initially this might appear cleaner | 13:41 |
| noonedeadpunk | I don't have really strong opinion but I catched myself that group_vars in osa repo is last place where I look for logic... | 13:46 |
| noonedeadpunk | We can actually make conditional in defaults/main.yml instead of template | 13:46 |
| noonedeadpunk | (or make it in vars with right to override) | 13:47 |
| opendevreview | Merged openstack/openstack-ansible-os_magnum master: Do not install python development packages https://review.opendev.org/c/openstack/openstack-ansible-os_magnum/+/824212 | 15:23 |
| *** dviroel|ruck is now known as dviroel|ruck|lunch | 15:48 | |
| *** dviroel|ruck|lunch is now known as dviroel|ruck | 16:46 | |
| opendevreview | Merged openstack/openstack-ansible-os_horizon stable/xena: horizon_local_settings.py.j2: adding SECURE_PROXY_ADDR_HEADER https://review.opendev.org/c/openstack/openstack-ansible-os_horizon/+/832908 | 17:47 |
| opendevreview | Merged openstack/openstack-ansible-os_horizon stable/wallaby: horizon_local_settings.py.j2: adding SECURE_PROXY_ADDR_HEADER https://review.opendev.org/c/openstack/openstack-ansible-os_horizon/+/832909 | 17:47 |
| opendevreview | Merged openstack/openstack-ansible-os_horizon stable/victoria: horizon_local_settings.py.j2: adding SECURE_PROXY_ADDR_HEADER https://review.opendev.org/c/openstack/openstack-ansible-os_horizon/+/833190 | 17:47 |
| opendevreview | Merged openstack/openstack-ansible-os_horizon stable/ussuri: horizon_local_settings.py.j2: adding SECURE_PROXY_ADDR_HEADER https://review.opendev.org/c/openstack/openstack-ansible-os_horizon/+/833191 | 17:47 |
| opendevreview | Merged openstack/openstack-ansible-os_keystone master: add oauth support https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/833017 | 18:00 |
| *** odyssey4me is now known as odyssey4me|away | 18:16 | |
| *** odyssey4me|away is now known as odyssey4me | 18:16 | |
| *** odyssey4me is now known as odyssey4me|away | 20:09 | |
| *** odyssey4me|away is now known as odyssey4me | 20:09 | |
| *** odyssey4me is now known as odyssey4me|away | 20:24 | |
| opendevreview | Merged openstack/openstack-ansible-os_neutron stable/xena: Change os_region to region_name https://review.opendev.org/c/openstack/openstack-ansible-os_neutron/+/831181 | 21:14 |
| *** dviroel|ruck is now known as dviroel|out | 21:19 | |
| *** odyssey4me|away is now known as odyssey4me | 22:08 | |
| *** odyssey4me is now known as odyssey4me|away | 22:09 | |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!